Is old JavaScript on my website a security risk?

Short answer: it can be. Many sites still load an old copy of jQuery, Bootstrap or another script library, often added by a theme or plugin years ago. When a library version has a published security hole, attackers know exactly what to look for, and the fix is usually just a newer version.

How to check it yourself

1. Open your homepage, view the page source, and search for the library name, for example jquery.
2. The version is usually in the file name or after ?ver=.
3. Look that version up in the GitHub Advisory Database to see whether it has known holes and which version fixes them.
4. Update the file, or on WordPress update the theme or plugin that loads it, then test the pages that use it.

What Preventionlabs shows

Every report lists the script libraries on your homepage that have published security holes, and every outside service your homepage loads scripts and files from. On WordPress sites it also checks the WordPress version and the plugins it can see against their latest releases. See the fix guide for outdated JavaScript libraries.

It checks from the outside, so it sees what your homepage loads, not files your server only uses internally.

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers

• How do I know if my website is secure, without a developer?
• Can people see my WordPress usernames?
• Are my WordPress plugins out of date?
• All questions